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The present invention relates to a method and device for model resolution and its use 
for detecting attacks against computer systems. 

The device comprises adapter software for translating the information from the log 
file, formulated in the specific language of the machine, into a language understandable by 
the interpreter, an interpreter receiving the information from the adapter and receiving the 
formulation of the specification in the temporal logic in a specification formula in order to 
expand this formula and fill in the table and the stack of worked subformulas described above 
resulting from the scaiming of the machine's log file, and a clause processing algorithm for 
resolving the Hom clauses using the information from the table and the stack of worked 
subformulas, this clause processing algorithm generating an output file or generating an 
action. 
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